feat(proxy): expose Hermes WebUI internally

Caddyfile

@@ -376,6 +376,13 @@ hermes.ginnoir.com {
 	}
 }
 
+# Hermes WebUI for browser/phone access to the valhalla Hermes runtime.
+# Internal-only; WebUI also enforces its own password auth.
+webui.ginnoir.com {
+	import internal_only
+	reverse_proxy 172.20.0.1:8787
+}
+
 backup.ginnoir.com {
 	route {
 		import authentik_outpost